@fidacy/openclaw-plugin 0.5.10 → 0.6.0

package/dist/index.js

@@ -4232,877 +4232,951 @@ import { createHash } from "node:crypto";
 import { appendFileSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join2 } from "node:path";
 
-// ../mcp/src/config.ts
-import { randomUUID } from "node:crypto";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  writeFileSync
-} from "node:fs";
-function hasEngineKey(keyOverride) {
-  return Boolean((keyOverride ?? process.env.FIDACY_ENGINE_API_KEY ?? "").trim());
-}
-function configDir() {
-  return process.env.FIDACY_CONFIG_DIR ?? join(homedir(), ".fidacy");
-}
-function configPath() {
-  return join(configDir(), "config.json");
-}
-function auditLogPath() {
-  if (process.env.FIDACY_AUDIT_PATH) return process.env.FIDACY_AUDIT_PATH;
-  const dir = join(configDir(), "audit");
-  try {
-    mkdirSync(dir, { recursive: true, mode: 448 });
-  } catch {
-  }
-  return join(dir, "audit.log");
+// ../firewall/dist/util.js
+function stableStringify(obj) {
+  if (obj === null || typeof obj !== "object")
+    return JSON.stringify(obj);
+  if (Array.isArray(obj))
+    return "[" + obj.map(stableStringify).join(",") + "]";
+  const keys = Object.keys(obj).sort();
+  return "{" + keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k])).join(",") + "}";
 }
-function readConfig() {
-  const p = configPath();
-  if (!existsSync(p)) return null;
-  try {
-    const raw = JSON.parse(readFileSync(p, "utf8"));
-    if (!raw || typeof raw.anon_id !== "string") return null;
-    return {
-      anon_id: raw.anon_id,
-      tier: raw.tier === "paid" ? "paid" : "free",
-      api_key: typeof raw.api_key === "string" ? raw.api_key : null,
-      mandate: raw.mandate,
-      // Install-state passthrough: dropping these on a read→write cycle would
-      // reset every once-per-install nudge into an every-time nag.
-      created_at: typeof raw.created_at === "string" ? raw.created_at : void 0,
-      nudges: raw.nudges && typeof raw.nudges === "object" ? raw.nudges : void 0,
-      decisions_count: typeof raw.decisions_count === "number" ? raw.decisions_count : void 0,
-      hosted_lapsed_at: typeof raw.hosted_lapsed_at === "string" ? raw.hosted_lapsed_at : void 0,
-      operator_email: typeof raw.operator_email === "string" ? raw.operator_email : void 0,
-      registered_email: typeof raw.registered_email === "string" ? raw.registered_email : void 0
-    };
-  } catch {
-    return null;
+
+// ../firewall/dist/signing.js
+import crypto from "node:crypto";
+function loadOrGenerateKeyPair() {
+  const b64 = process.env.FIDACY_SIGNING_KEY_B64;
+  if (b64) {
+    const pem = Buffer.from(b64, "base64").toString("utf8");
+    const privateKey2 = crypto.createPrivateKey(pem);
+    const publicKey2 = crypto.createPublicKey(privateKey2);
+    return { privateKey: privateKey2, publicKey: publicKey2, ephemeral: false };
   }
+  const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519");
+  return { privateKey, publicKey, ephemeral: true };
 }
-function writeConfig(cfg) {
-  const dir = configDir();
-  mkdirSync(dir, { recursive: true, mode: 448 });
-  writeFileSync(configPath(), JSON.stringify(cfg, null, 2), { mode: 384 });
+function publicKeyPem(publicKey) {
+  return publicKey.export({ type: "spki", format: "pem" }).toString();
 }
-function ensureState() {
-  const existing = readConfig();
-  if (existing) return { config: existing, firstRun: false };
-  const config = {
-    anon_id: randomUUID(),
-    tier: "free",
-    api_key: null,
-    mandate: { payees: [], categories: ["*"], currency: "USD", perTxMax: 2500, maxTotal: 1e4 },
-    created_at: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  try {
-    writeConfig(config);
-  } catch {
-  }
-  return { config, firstRun: true };
+function sign(privateKey, message) {
+  return crypto.sign(null, Buffer.from(message, "utf8"), privateKey).toString("base64url");
 }
-var DEMO_PAYEE = "fidacy:demo";
-function resolveMandateRules(cfg) {
-  const m = cfg?.mandate ?? {};
-  const envList = (v) => v === void 0 ? void 0 : v.split(",").map((s) => s.trim()).filter(Boolean);
-  const envNum = (name, v) => {
-    if (v === void 0 || v.trim() === "") return void 0;
-    const n = Number(v);
-    if (!Number.isFinite(n) || n <= 0) {
-      console.error(
-        `[fidacy] ${name}="${v}" is not a positive number, so it cannot be enforced as a cap. Ignoring it and using the safe default. Write digits only, with no thousands separator, currency symbol or unit (e.g. ${name}=2500).`
-      );
-      return void 0;
-    }
-    return n;
-  };
-  const fileNum = (name, v) => {
-    if (v === void 0 || v === null) return void 0;
-    const n = typeof v === "number" ? v : typeof v === "string" ? Number(v.trim()) : NaN;
-    if (!Number.isFinite(n) || n <= 0) {
-      console.error(
-        `[fidacy] mandate.${name} in config.json is ${JSON.stringify(v)}, which is not a positive number, so it cannot be enforced as a cap. Ignoring it and using the safe default. Write it as a bare JSON number, with no quotes, thousands separator, currency symbol or unit (e.g. "${name}": 2500).`
-      );
-      return void 0;
-    }
-    return n;
-  };
-  const payees = envList(process.env.FIDACY_ALLOW_PAYEES) ?? m.payees ?? [];
-  return {
-    payees: payees.includes(DEMO_PAYEE) ? payees : [...payees, DEMO_PAYEE],
-    categories: envList(process.env.FIDACY_ALLOW_CATEGORIES) ?? m.categories ?? ["*"],
-    currency: process.env.FIDACY_CURRENCY ?? m.currency ?? "USD",
-    perTxMax: envNum("FIDACY_PER_TX_MAX", process.env.FIDACY_PER_TX_MAX) ?? fileNum("perTxMax", m.perTxMax) ?? 2500,
-    maxTotal: envNum("FIDACY_MAX_TOTAL", process.env.FIDACY_MAX_TOTAL) ?? fileNum("maxTotal", m.maxTotal) ?? 1e4
-  };
+function sha256(input) {
+  return crypto.createHash("sha256").update(input).digest("hex");
 }
 
-// ../mcp/src/evidence.ts
-var GENESIS = "fidacy.observer.v1";
-var sha256 = (s) => createHash("sha256").update(s).digest("hex");
-function canonical(obj) {
-  const keys = Object.keys(obj).sort();
-  return "{" + keys.map((k) => `${JSON.stringify(k)}:${JSON.stringify(obj[k])}`).join(",") + "}";
-}
-function chainStep(prevHead, a) {
-  return sha256(`${prevHead}|${sha256(canonical({ category: a.category, i: a.i, tool: a.tool, ts: a.ts }))}`);
-}
-function genesisHead() {
-  return sha256(GENESIS);
+// ../firewall/dist/audit-store.js
+import fs from "node:fs";
+
+// ../firewall/dist/core.js
+import { randomUUID } from "node:crypto";
+
+// ../firewall/dist/evaluate.js
+function fold(s) {
+  return s.toLowerCase().replace(/[4@]/g, "a").replace(/[0]/g, "o").replace(/[1|!]/g, "l").replace(/[3]/g, "e").replace(/[5$]/g, "s").replace(/[7]/g, "t").replace(/[^a-z0-9]/g, "");
 }
-function fidacyDir() {
-  return join2(configDir(), "sessions");
+function lev(a, b, max) {
+  if (Math.abs(a.length - b.length) > max)
+    return max + 1;
+  let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+  for (let i = 1; i <= a.length; i++) {
+    const cur = [i];
+    let rowMin = i;
+    for (let j = 1; j <= b.length; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      const v = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + cost);
+      cur[j] = v;
+      if (v < rowMin)
+        rowMin = v;
+    }
+    if (rowMin > max)
+      return max + 1;
+    prev = cur;
+  }
+  return prev[b.length];
 }
-function writeSessionLog(sessionId, actions, head, meta) {
-  try {
-    const dir = fidacyDir();
-    mkdirSync2(dir, { recursive: true, mode: 448 });
-    const safe = sessionId.replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 80) || "session";
-    const path = join2(dir, `${safe}.json`);
-    const body = {
-      v: "fidacy.observer.v1",
-      recipe: 'h_0 = sha256("fidacy.observer.v1"); h_i = sha256(h_prev + "|" + sha256(canonical(action)))',
-      sessionId,
-      head,
-      ...meta,
-      actions
-    };
-    writeFileSync2(path, JSON.stringify(body, null, 2), { mode: 384 });
-    return path;
-  } catch {
+function lookalikePayee(payee, allowed) {
+  const exact = new Set(allowed);
+  if (exact.has(payee) || allowed.includes("*"))
+    return null;
+  const pf = fold(payee);
+  if (pf.length < 4)
     return null;
+  for (const a of allowed) {
+    if (a === "*")
+      continue;
+    const af = fold(a);
+    if (af.length < 4)
+      continue;
+    if (pf === af)
+      return a;
+    const d = lev(pf, af, 2);
+    if (d > 0 && d <= 2)
+      return a;
   }
+  return null;
 }
-function queuePending(head, sessionId, at, total = 0, byCategory = {}) {
-  try {
-    const dir = fidacyDir();
-    mkdirSync2(dir, { recursive: true, mode: 448 });
-    appendFileSync(join2(dir, "pending-anchors.jsonl"), JSON.stringify({ head, sessionId, at, total, byCategory }) + "\n", {
-      mode: 384
-    });
-  } catch {
+function validateMandateCaps(mandate) {
+  const bad = (v) => typeof v !== "number" || !Number.isFinite(v) || v <= 0;
+  if (!mandate.allow || typeof mandate.allow !== "object")
+    return "invalid_mandate:missing_allow";
+  if (bad(mandate.allow.perTxMax))
+    return `invalid_mandate_cap:perTxMax=${String(mandate.allow.perTxMax)}`;
+  if (bad(mandate.allow.maxTotal))
+    return `invalid_mandate_cap:maxTotal=${String(mandate.allow.maxTotal)}`;
+  if (!mandate.window || typeof mandate.window !== "object")
+    return "invalid_mandate:missing_window";
+  for (const campo of ["notBefore", "notAfter"]) {
+    const v = mandate.window[campo];
+    if (typeof v !== "string" || Number.isNaN(Date.parse(v)))
+      return `invalid_mandate_window:${campo}=${String(v)}`;
   }
+  return null;
 }
-function takePending(limit = 50) {
-  const dir = fidacyDir();
-  const path = join2(dir, "pending-anchors.jsonl");
-  const taken = join2(dir, "pending-anchors.taking");
-  try {
-    renameSync(path, taken);
-  } catch {
-    return [];
+function evaluate(mandate, req, spentSoFar) {
+  const now = Date.now();
+  if (mandate.revoked)
+    return "mandate_revoked";
+  const badCap = validateMandateCaps(mandate);
+  if (badCap)
+    return badCap;
+  if (now < Date.parse(mandate.window.notBefore))
+    return "before_mandate_window";
+  if (now > Date.parse(mandate.window.notAfter))
+    return "after_mandate_window";
+  if (req.currency.toUpperCase() !== mandate.allow.currency.toUpperCase())
+    return `currency_not_allowed:${req.currency}`;
+  if (req.amount <= 0)
+    return "non_positive_amount";
+  if (req.amount > mandate.allow.perTxMax)
+    return `per_tx_cap_exceeded:${req.amount}>${mandate.allow.perTxMax}`;
+  if (spentSoFar + req.amount > mandate.allow.maxTotal)
+    return `total_cap_exceeded:${spentSoFar + req.amount}>${mandate.allow.maxTotal}`;
+  const payeeOk = mandate.allow.payees.includes("*") || mandate.allow.payees.includes(req.payee);
+  if (!payeeOk) {
+    const impersonated = lookalikePayee(req.payee, mandate.allow.payees);
+    if (impersonated)
+      return `payee_lookalike:${req.payee}~${impersonated}`;
+    return `payee_not_in_allowlist:${req.payee}`;
   }
+  const catOk = mandate.allow.categories.includes("*") || mandate.allow.categories.includes(req.category);
+  if (!catOk)
+    return `category_not_allowed:${req.category}`;
+  return null;
+}
+
+// ../firewall/dist/core.js
+function canonInvoice(ref) {
+  if (typeof ref !== "string")
+    return "";
+  return ref.normalize("NFC").replace(/[\s\u200B\u200C\u200D\uFEFF]+/g, "").toLowerCase();
+}
+function validateRequest(req) {
+  if (!req || typeof req !== "object")
+    return "invalid_request";
+  if (typeof req.amount !== "number" || !Number.isFinite(req.amount) || req.amount <= 0)
+    return "invalid_amount";
+  if (typeof req.payee !== "string" || req.payee.length === 0)
+    return "invalid_payee";
+  if (typeof req.currency !== "string" || req.currency.length === 0)
+    return "invalid_currency";
+  return null;
+}
+function requireHttpsBase(raw) {
+  const trimmed = String(raw ?? "").replace(/\/+$/, "");
+  let u;
   try {
-    const lines = readFileSync2(taken, "utf8").split("\n").filter(Boolean);
-    const out = [];
-    for (const line of lines.slice(-limit)) {
-      try {
-        const p = JSON.parse(line);
-        if (typeof p.head === "string" && /^[0-9a-f]{64}$/.test(p.head)) out.push(p);
-      } catch {
-      }
-    }
-    return out;
+    u = new URL(trimmed);
   } catch {
-    return [];
-  } finally {
-    try {
-      writeFileSync2(taken, "");
-    } catch {
-    }
+    throw new Error("FIDACY_API_URL is not a valid URL");
   }
-}
-function verifyUrl(head) {
-  return `https://fidacy.com/verify?sha256=${head}`;
-}
-var CODE = {
-  money: "m",
-  shell: "s",
-  file: "f",
-  network: "net",
-  message: "msg",
-  other: "o"
-};
-function sessionLabel(sessionId, total, byCategory) {
-  const id = sessionId.replace(/[^A-Za-z0-9-]/g, "").slice(0, 8) || "unknown";
-  const parts = [`session:${id}`, `n=${total}`];
-  for (const [cat, code] of Object.entries(CODE)) {
-    const n = byCategory[cat] ?? 0;
-    if (n > 0) parts.push(`${code}=${n}`);
+  const localHttp = u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]");
+  if (u.protocol !== "https:" && !localHttp) {
+    throw new Error("FIDACY_API_URL must be https:// (the API key is sent to it)");
   }
-  return parts.join(" ").slice(0, 120);
-}
-function sessionSummary(opts) {
-  const by = {};
-  for (const [cat, n] of Object.entries(opts.byCategory)) if (n > 0) by[cat] = n;
-  const s = {
-    v: 1,
-    // Mesmo saneamento do rótulo: o host vem de código nosso, mas o campo é
-    // limitado na origem para que uma string estranha vire um valor curto e
-    // legível em vez de um 400 que perderia o registro inteiro da sessão.
-    host: opts.host.replace(/[^a-z0-9-]/gi, "").slice(0, 40) || "unknown",
-    session_id: opts.sessionId.replace(/[^A-Za-z0-9-]/g, "").slice(0, 64) || "unknown",
-    total: opts.total
-  };
-  if (Object.keys(by).length) s.by_category = by;
-  if (opts.truncated) s.truncated = true;
-  if (opts.startedAt) s.started_at = opts.startedAt;
-  if (opts.endedAt) s.ended_at = opts.endedAt;
-  return s;
+  return trimmed;
 }
-
-// ../mcp/src/observer.ts
-var EXACT = {
-  // Fidacy's own money tools, so the report counts what we ourselves gated.
-  request_payment: "money",
-  assess_action: "money",
-  // The common OpenClaw / agent-host tool vocabulary.
-  bash: "shell",
-  shell: "shell",
-  exec: "shell",
-  run_command: "shell",
-  code_mode_exec: "shell",
-  read: "file",
-  read_file: "file",
-  write: "file",
-  write_file: "file",
-  edit: "file",
-  edit_file: "file",
-  apply_patch: "file",
-  glob: "file",
-  grep: "file",
-  ls: "file",
-  fetch: "network",
-  web_fetch: "network",
-  web_search: "network",
-  http_request: "network",
-  browser: "network",
-  send_message: "message",
-  reply: "message",
-  send_email: "message"
+var DevFidacyCore = class {
+  priv;
+  pubPem;
+  mandate;
+  store;
+  spent = 0;
+  claimedInvoices = /* @__PURE__ */ new Set();
+  onDecision;
+  constructor(opts) {
+    const kp = loadOrGenerateKeyPair();
+    this.priv = kp.privateKey;
+    this.pubPem = publicKeyPem(kp.publicKey);
+    if (kp.ephemeral)
+      console.error("[fidacy] local firewall active, deny-by-default. Grants are signed with a per-session key (fine for local use); set FIDACY_SIGNING_KEY_B64 for a stable key, or FIDACY_MODE=http to use the hosted core.");
+    this.mandate = opts.mandate;
+    this.store = new FileAuditStore(opts.auditLogPath ?? "./fidacy-audit.log");
+    this.onDecision = opts.onDecision;
+    this.rehydrate();
+  }
+  /**
+   * Rebuild the in-memory decision state from the persisted audit log, so a process
+   * restart cannot re-open a claimed invoice (BEC dedup) or reset the maxTotal
+   * counter. One O(records) pass at boot over the already-loaded chain:
+   *   - claimedInvoices: every ALLOW that carried an invoiceRef, regardless of age —
+   *     a paid invoice stays paid.
+   *   - spent: ALLOW amounts whose timestamp falls inside the CURRENT mandate window
+   *     and whose currency matches the mandate (the cap is defined per window/currency).
+   * Records from older versions lack the rehydration fields and are skipped.
+   */
+  rehydrate() {
+    const notBefore = Date.parse(this.mandate.window.notBefore);
+    const notAfter = Date.parse(this.mandate.window.notAfter);
+    for (const r of this.store.records()) {
+      if (r.status !== "ALLOW")
+        continue;
+      if (r.invoiceRef)
+        this.claimedInvoices.add(`${r.subject}|${r.invoiceRef}`);
+      if (typeof r.amount !== "number" || !Number.isFinite(r.amount))
+        continue;
+      if (r.currency !== this.mandate.allow.currency)
+        continue;
+      const t = Date.parse(r.ts);
+      if (!Number.isFinite(t) || t < notBefore || t > notAfter)
+        continue;
+      this.spent += r.amount;
+    }
+  }
+  /**
+   * Swap the active mandate (shell config hot-reload: edit config.json, the next
+   * call picks it up, no host restart). Decision state is REBUILT from the audit
+   * log under the new window/currency, so a reload can never reset the BEC
+   * invoice dedup or undercount spend: a paid invoice stays paid, spent is
+   * recomputed.
+   */
+  setMandate(m) {
+    this.mandate = m;
+    this.spent = 0;
+    this.claimedInvoices.clear();
+    this.rehydrate();
+  }
+  async getMandate() {
+    return this.mandate;
+  }
+  async decide(req, subject) {
+    const decisionId = randomUUID();
+    const ts2 = (/* @__PURE__ */ new Date()).toISOString();
+    const invalid = validateRequest(req);
+    if (invalid) {
+      const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: invalid, ts: ts2 };
+      this.store.append(decision2);
+      this.onDecision?.(decision2);
+      return decision2;
+    }
+    const violated = evaluate(this.mandate, req, this.spent);
+    if (violated) {
+      const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: violated, ts: ts2 };
+      this.store.append(decision2);
+      this.onDecision?.(decision2);
+      return decision2;
+    }
+    const invoice = canonInvoice(req.invoiceRef);
+    if (invoice) {
+      const k = `${subject}|${invoice}`;
+      if (this.claimedInvoices.has(k)) {
+        const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: `duplicate_invoice:${invoice}`, ts: ts2 };
+        this.store.append(decision2);
+        this.onDecision?.(decision2);
+        return decision2;
+      }
+      this.claimedInvoices.add(k);
+    }
+    const grantPayload = { decisionId, subject, payee: req.payee, amount: req.amount, currency: req.currency, exp: Date.now() + 12e4, ...req.invoiceRef ? { invoiceRef: req.invoiceRef } : {} };
+    const grantBody = Buffer.from(stableStringify(grantPayload), "utf8").toString("base64url");
+    const grant = `${grantBody}.${sign(this.priv, grantBody)}`;
+    const decision = { decisionId, status: "ALLOW", subject, mandateId: this.mandate.id, request: req, grant, ts: ts2 };
+    this.spent += req.amount;
+    this.store.append(decision);
+    this.onDecision?.(decision);
+    return decision;
+  }
+  async getProof(decisionId) {
+    const record3 = this.store.find(decisionId);
+    if (!record3)
+      return null;
+    return { record: record3, chainIntact: this.store.intact(), verifiedAgainstPublicKey: this.pubPem };
+  }
+  async history(limit = 50) {
+    const all = this.store.records();
+    return limit > 0 && all.length > limit ? all.slice(-limit) : all;
+  }
+  publicKey() {
+    return this.pubPem;
+  }
 };
-var FUZZY = [
-  ["payment", "money"],
-  ["invoice", "money"],
-  ["transfer", "money"],
-  ["charge", "money"],
-  ["file", "file"],
-  ["patch", "file"],
-  ["write", "file"],
-  ["read", "file"],
-  ["fetch", "network"],
-  ["http", "network"],
-  ["browser", "network"],
-  ["search", "network"],
-  ["exec", "shell"],
-  ["command", "shell"],
-  ["shell", "shell"],
-  ["mail", "message"],
-  ["message", "message"],
-  ["send", "message"]
-];
-function classify(toolName, derivedPaths) {
-  const name = toolName.toLowerCase();
-  const exact = EXACT[name];
-  if (exact) return exact;
-  if (derivedPaths && derivedPaths.length > 0) return "file";
-  for (const [needle, category] of FUZZY) if (name.includes(needle)) return category;
-  return "other";
-}
-function fingerprint(toolName, derivedPaths) {
-  const target = derivedPaths && derivedPaths.length > 0 ? [...derivedPaths].sort().join("\0") : toolName;
-  return createHash2("sha256").update(`${toolName}\0${target}`).digest("hex").slice(0, 16);
-}
-var ACTION_LOG_CAP = 5e3;
-function newLedger(sessionId, now) {
-  return {
-    sessionId,
-    startedAt: now,
-    byCategory: /* @__PURE__ */ new Map(),
-    total: 0,
-    toolsSeen: /* @__PURE__ */ new Set(),
-    head: genesisHead(),
-    actions: [],
-    truncated: false
-  };
-}
-function record(ledger, toolName, derivedPaths, failed = false, at = Date.now()) {
-  const category = classify(toolName, derivedPaths);
-  let tally = ledger.byCategory.get(category);
-  if (!tally) {
-    tally = { calls: 0, failures: 0, targets: /* @__PURE__ */ new Set() };
-    ledger.byCategory.set(category, tally);
+var HttpFidacyCore = class {
+  apiKey;
+  subjectPub;
+  baseUrl;
+  // Enforce https before any key-bearing request — a hostile FIDACY_API_URL would
+  // otherwise exfiltrate the API key in the Authorization header.
+  constructor(baseUrl, apiKey, subjectPub = "") {
+    this.apiKey = apiKey;
+    this.subjectPub = subjectPub;
+    this.baseUrl = requireHttpsBase(baseUrl);
+  }
+  async call(path, body) {
+    const res = await fetch(`${this.baseUrl}${path}`, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${this.apiKey}` },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok)
+      throw new Error(`fidacy core ${path} -> ${res.status}`);
+    return await res.json();
   }
-  tally.calls += 1;
-  if (failed) tally.failures += 1;
-  if (derivedPaths && derivedPaths.length > 0 && tally.targets.size < TARGET_CAP) {
-    tally.targets.add(fingerprint(toolName, derivedPaths));
+  async getMandate(subject) {
+    return this.call("/v1/mandate/get", { subject });
   }
-  ledger.total += 1;
-  if (ledger.toolsSeen.size < TOOLS_CAP) ledger.toolsSeen.add(toolName);
-  const action = {
-    i: ledger.total,
-    category,
-    tool: toolName,
-    ts: new Date(at).toISOString()
-  };
-  ledger.head = chainStep(ledger.head, action);
-  if (ledger.actions.length < ACTION_LOG_CAP) ledger.actions.push(action);
-  else ledger.truncated = true;
-}
-var TARGET_CAP = 500;
-var TOOLS_CAP = 200;
-var ORDER = ["money", "shell", "file", "network", "message", "other"];
-var LABEL = {
-  money: "moved money",
-  shell: "ran commands",
-  file: "touched files",
-  network: "reached the network",
-  message: "sent messages",
-  other: "other"
-};
-function renderReport(ledger, now, activated, logPath) {
-  if (ledger.total < MIN_ACTIONS_FOR_REPORT) return null;
-  const minutes = Math.max(1, Math.round((now - ledger.startedAt) / 6e4));
-  const lines = [];
-  lines.push(
-    `[fidacy] SESSION REPORT \xB7 ${ledger.total} agent actions watched over ${minutes} min \xB7 nothing left this machine`
-  );
-  for (const category of ORDER) {
-    const tally = ledger.byCategory.get(category);
-    if (!tally) continue;
-    const capped = tally.targets.size >= TARGET_CAP ? "+" : "";
-    const parts = [`${tally.calls} ${tally.calls === 1 ? "call" : "calls"}`];
-    if (tally.targets.size > 0) parts.push(`${tally.targets.size}${capped} distinct`);
-    if (tally.failures > 0) parts.push(`${tally.failures} failed`);
-    lines.push(`[fidacy]   ${LABEL[category].padEnd(20)} ${parts.join(" \xB7 ")}`);
+  async decide(req, subject) {
+    return this.call("/v1/decide", { req, subject });
   }
-  const money2 = ledger.byCategory.get("money");
-  if (!money2) {
-    lines.push(`[fidacy]   no money-moving action was attempted \xB7 the firewall stayed armed and idle`);
+  async getProof(decisionId) {
+    return this.call("/v1/audit/proof", { decisionId });
   }
-  lines.push(`[fidacy]   digest    ${ledger.head}`);
-  if (logPath) lines.push(`[fidacy]   log       ${logPath}${ledger.truncated ? " (partial: action cap reached)" : ""}`);
-  lines.push(
-    activated ? `[fidacy]   anchored to the audit chain \xB7 verify: ${verifyUrl(ledger.head)}` : `[fidacy]   activate free to anchor this digest so nobody can rewrite it later: https://fidacy.com/claim`
-  );
-  return lines.join("\n");
-}
-var MIN_ACTIONS_FOR_REPORT = 5;
-function installObserver(api, emit, isActivated, now = Date.now, anchor) {
-  if (typeof api?.on !== "function") return;
-  const ledgers = /* @__PURE__ */ new Map();
-  const LEDGER_CAP = 50;
-  const ledgerFor = (sessionId) => {
-    let ledger = ledgers.get(sessionId);
-    if (!ledger) {
-      if (ledgers.size >= LEDGER_CAP) ledgers.delete(ledgers.keys().next().value);
-      ledger = newLedger(sessionId, now());
-      ledgers.set(sessionId, ledger);
-    }
-    return ledger;
-  };
-  api.on(
-    "before_tool_call",
-    (event, ctx) => {
+  async history(limit = 50) {
+    const res = await this.call("/v1/audit/list", { limit });
+    return res.records ?? [];
+  }
+  publicKey() {
+    return this.subjectPub;
+  }
+};
+
+// ../firewall/dist/audit-store.js
+var FileAuditStore = class {
+  path;
+  chain = [];
+  constructor(path) {
+    this.path = path;
+    this.load();
+  }
+  load() {
+    if (!fs.existsSync(this.path))
+      return;
+    try {
+      const raw = fs.readFileSync(this.path, "utf8");
+      const lines = raw.split("\n");
+      const parsed = [];
+      let torn = false;
+      for (let i = 0; i < lines.length; i++) {
+        if (!lines[i].trim())
+          continue;
+        try {
+          parsed.push(JSON.parse(lines[i]));
+        } catch {
+          if (lines.slice(i + 1).some((l) => l.trim()))
+            throw new Error(`unparseable record at line ${i + 1}`);
+          torn = true;
+          break;
+        }
+      }
+      this.chain = parsed;
+      if (!this.intact())
+        throw new Error("audit chain integrity broken");
+      if (torn) {
+        const clean = parsed.map((r) => JSON.stringify(r)).join("\n") + (parsed.length ? "\n" : "");
+        fs.writeFileSync(this.path, clean);
+        console.error(`[fidacy] audit log at ${this.path} had a torn trailing line (crash during append?); salvaged ${parsed.length} intact records and truncated the tail.`);
+      }
+    } catch (err) {
+      this.chain = [];
       try {
-        const toolName = typeof event.toolName === "string" ? event.toolName : "unknown";
-        const paths = Array.isArray(event.derivedPaths) ? event.derivedPaths : void 0;
-        const sessionId = sessionIdOf(ctx);
-        record(ledgerFor(sessionId), toolName, paths, false);
+        const quarantine = `${this.path}.corrupt-${Date.now()}`;
+        fs.renameSync(this.path, quarantine);
+        console.error(`[fidacy] audit log at ${this.path} is unreadable/tampered (${err.message}); quarantined to ${quarantine}, starting a fresh chain.`);
       } catch {
+        console.error(`[fidacy] audit log at ${this.path} is unreadable/tampered and could not be quarantined; starting a fresh in-memory chain.`);
       }
-    },
-    // Lowest priority on purpose: anything that actually decides should run first,
-    // and we only want to count what the host was really about to do.
-    { priority: 1 }
-  );
-  api.on("session_end", async (event, ctx) => {
-    try {
-      const sessionId = sessionIdOf(ctx) || (typeof event.sessionId === "string" ? event.sessionId : "");
-      const ledger = ledgers.get(sessionId);
-      if (!ledger) return;
-      ledgers.delete(sessionId);
-      if (ledger.total < MIN_ACTIONS_FOR_REPORT) return;
-      const logPath = persist(ledger, now());
-      let anchored = false;
-      if (anchor) {
-        anchored = await anchor(ledger.head, ledger.sessionId, rollup(ledger)).catch(() => false);
-      }
-      if (!anchored) queuePending(ledger.head, ledger.sessionId, now(), ledger.total, rollup(ledger));
-      const report = renderReport(ledger, now(), anchored, logPath);
-      if (report) emit(report);
-    } catch {
     }
-  });
-  api.on("gateway_stop", () => drain());
-  process.on("exit", () => drain());
-  function drain() {
-    try {
-      for (const [id, ledger] of ledgers) {
-        ledgers.delete(id);
-        if (ledger.total < MIN_ACTIONS_FOR_REPORT) continue;
-        const logPath = persist(ledger, now());
-        queuePending(ledger.head, ledger.sessionId, now(), ledger.total, rollup(ledger));
-        const report = renderReport(ledger, now(), false, logPath);
-        if (report) emit(report);
-      }
-    } catch {
+  }
+  head() {
+    return this.chain.length ? this.chain[this.chain.length - 1].hash : "GENESIS";
+  }
+  append(decision) {
+    const prevHash = this.head();
+    const seq = this.chain.length;
+    const ts2 = decision.ts;
+    const digest = sha256(stableStringify({ decisionId: decision.decisionId, status: decision.status, request: decision.request, violatedRule: decision.violatedRule ?? null }));
+    const hash = sha256(`${prevHash}|${digest}|${seq}|${ts2}`);
+    const record3 = { seq, decisionId: decision.decisionId, status: decision.status, subject: decision.subject, digest, prevHash, hash, ts: ts2 };
+    if (typeof decision.request?.purpose === "string" && decision.request.purpose.trim()) {
+      record3.purpose = decision.request.purpose.slice(0, 500);
+    }
+    if (typeof decision.request?.payee === "string" && decision.request.payee.trim()) {
+      record3.payee = decision.request.payee.slice(0, 200);
+    }
+    if (decision.status === "ALLOW") {
+      const req = decision.request;
+      if (typeof req?.amount === "number" && Number.isFinite(req.amount))
+        record3.amount = req.amount;
+      if (typeof req?.currency === "string")
+        record3.currency = req.currency;
+      const invoice = canonInvoice(req?.invoiceRef);
+      if (invoice)
+        record3.invoiceRef = invoice;
+    } else {
+      if (decision.violatedRule)
+        record3.violatedRule = decision.violatedRule;
+      const req = decision.request;
+      if (typeof req?.amount === "number" && Number.isFinite(req.amount))
+        record3.amount = req.amount;
+      if (typeof req?.currency === "string")
+        record3.currency = req.currency;
     }
+    fs.appendFileSync(this.path, JSON.stringify(record3) + "\n");
+    this.chain.push(record3);
+    return record3;
   }
-  function rollup(ledger) {
-    const out = {};
-    for (const [cat, tally] of ledger.byCategory) out[cat] = tally.calls;
-    return out;
+  find(decisionId) {
+    return this.chain.find((r) => r.decisionId === decisionId);
   }
-  function persist(ledger, at) {
-    return writeSessionLog(ledger.sessionId, ledger.actions, ledger.head, {
-      startedAt: new Date(ledger.startedAt).toISOString(),
-      endedAt: new Date(at).toISOString(),
-      totalActions: ledger.total,
-      truncated: ledger.truncated,
-      byCategory: Object.fromEntries(
-        [...ledger.byCategory].map(([k, v]) => [k, { calls: v.calls, failures: v.failures, distinct: v.targets.size }])
-      )
-    });
+  /** The full loaded chain, oldest first. Read-only; used to rehydrate core state at boot. */
+  records() {
+    return this.chain;
   }
-}
-function sessionIdOf(ctx) {
-  if (!ctx) return "default";
-  const id = ctx.sessionId ?? ctx.sessionKey;
-  return typeof id === "string" && id.length > 0 ? id : "default";
-}
-
-// ../firewall/dist/util.js
-function stableStringify(obj) {
-  if (obj === null || typeof obj !== "object")
-    return JSON.stringify(obj);
-  if (Array.isArray(obj))
-    return "[" + obj.map(stableStringify).join(",") + "]";
-  const keys = Object.keys(obj).sort();
-  return "{" + keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k])).join(",") + "}";
-}
-
-// ../firewall/dist/signing.js
-import crypto from "node:crypto";
-function loadOrGenerateKeyPair() {
-  const b64 = process.env.FIDACY_SIGNING_KEY_B64;
-  if (b64) {
-    const pem = Buffer.from(b64, "base64").toString("utf8");
-    const privateKey2 = crypto.createPrivateKey(pem);
-    const publicKey2 = crypto.createPublicKey(privateKey2);
-    return { privateKey: privateKey2, publicKey: publicKey2, ephemeral: false };
+  intact() {
+    let prev = "GENESIS";
+    for (const r of this.chain) {
+      const expected = sha256(`${prev}|${r.digest}|${r.seq}|${r.ts}`);
+      if (expected !== r.hash || r.prevHash !== prev)
+        return false;
+      prev = r.hash;
+    }
+    return true;
   }
-  const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519");
-  return { privateKey, publicKey, ephemeral: true };
-}
-function publicKeyPem(publicKey) {
-  return publicKey.export({ type: "spki", format: "pem" }).toString();
-}
-function sign(privateKey, message) {
-  return crypto.sign(null, Buffer.from(message, "utf8"), privateKey).toString("base64url");
-}
-function sha2562(input) {
-  return crypto.createHash("sha256").update(input).digest("hex");
-}
+};
 
-// ../firewall/dist/audit-store.js
-import fs from "node:fs";
+// ../firewall/dist/destination.js
+function normalizeKeepingEdges(raw) {
+  return String(raw ?? "").normalize("NFKC").toLowerCase().replace(/[​-‍⁠­]/g, "").replace(/(?<=[a-z0-9])[_\-.]+(?=[a-z0-9])/g, ".").replace(/\s+/g, " ");
+}
+
+// ../firewall/dist/action-classes.js
+var ACTION_CLASSES = [
+  {
+    id: "credential.access",
+    label: "Read secrets and credentials",
+    incident: "Stops the agent from reading your API keys, tokens or .env files, which is step one of nearly every real breach.",
+    patterns: ["secret", "credential", "apikey", "api_key", "token.read", ".env", "vault", "keychain", "password"],
+    defaultMode: "log"
+  },
+  {
+    id: "data.exfiltrate",
+    label: "Send data outside the approved environment",
+    incident: "Stops the agent from uploading or posting your data to somewhere nobody approved, which is what a prompt injection turns into a leak.",
+    patterns: ["exfil", "upload", "s3.put", "bucket.write", "external.post", "webhook.send", "http.post", "share.create", "publish"],
+    defaultMode: "log"
+  },
+  {
+    id: "file.delete",
+    label: "Delete files",
+    incident: "Stops the agent from deleting files or emptying a folder, which is the mistake nobody can undo.",
+    patterns: ["file.delete", "file.remove", "fs.unlink", "rm ", "rmdir", "delete.file", "bucket.delete", "object.delete"],
+    defaultMode: "log"
+  },
+  {
+    id: "db.write",
+    label: "Write or drop in a production database",
+    incident: "Stops the agent from running DELETE, DROP or a migration against your production data.",
+    patterns: ["db.write", "db.delete", "db.drop", "sql.exec", "migration", "truncate", "drop table", "delete from"],
+    defaultMode: "log"
+  },
+  {
+    id: "system.critical",
+    label: "Touch production systems and permissions",
+    incident: "Stops the agent from deploying, changing IAM or altering infrastructure, the actions your security team asks about first.",
+    patterns: ["deploy", "iam.", "role.grant", "permission.set", "infra.", "terraform", "kubectl", "shutdown", "scale."],
+    defaultMode: "log"
+  },
+  {
+    id: "crm.export",
+    label: "Export customer records in bulk",
+    incident: "Stops the agent from exporting your customer base, the action that turns a mistake into a reportable data-protection incident.",
+    patterns: ["crm.export", "contacts.export", "customer.export", "report.export", "bulk.export", "download.all"],
+    defaultMode: "log"
+  },
+  {
+    id: "email.send",
+    label: "Send email or messages outside your domain",
+    incident: "Stops the agent from emailing or messaging someone outside your organisation, the channel invoice fraud travels on.",
+    patterns: ["email.send", "mail.send", "message.send", "sms.send", "slack.post", "notify.external"],
+    defaultMode: "log"
+  },
+  {
+    id: "payment.transfer",
+    label: "Move money",
+    incident: "Stops the agent from paying, transferring or refunding without authority, which is the firewall Fidacy started with.",
+    patterns: ["payment", "transfer", "refund", "payout", "charge", "invoice.pay", "wire"],
+    defaultMode: "log"
+  }
+];
+var BY_ID = new Map(ACTION_CLASSES.map((c) => [c.id, c]));
+var NORMALIZED_PATTERNS = new Map(ACTION_CLASSES.map((k) => [k.id, k.patterns.map((p) => normalizeKeepingEdges(p))]));
 
-// ../firewall/dist/core.js
+// ../mcp/src/config.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
-
-// ../firewall/dist/evaluate.js
-function fold(s) {
-  return s.toLowerCase().replace(/[4@]/g, "a").replace(/[0]/g, "o").replace(/[1|!]/g, "l").replace(/[3]/g, "e").replace(/[5$]/g, "s").replace(/[7]/g, "t").replace(/[^a-z0-9]/g, "");
+import { homedir } from "node:os";
+import { join } from "node:path";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "node:fs";
+function hasEngineKey(keyOverride) {
+  return Boolean((keyOverride ?? process.env.FIDACY_ENGINE_API_KEY ?? "").trim());
 }
-function lev(a, b, max) {
-  if (Math.abs(a.length - b.length) > max)
-    return max + 1;
-  let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
-  for (let i = 1; i <= a.length; i++) {
-    const cur = [i];
-    let rowMin = i;
-    for (let j = 1; j <= b.length; j++) {
-      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-      const v = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + cost);
-      cur[j] = v;
-      if (v < rowMin)
-        rowMin = v;
-    }
-    if (rowMin > max)
-      return max + 1;
-    prev = cur;
-  }
-  return prev[b.length];
+function configDir() {
+  return process.env.FIDACY_CONFIG_DIR ?? join(homedir(), ".fidacy");
 }
-function lookalikePayee(payee, allowed) {
-  const exact = new Set(allowed);
-  if (exact.has(payee) || allowed.includes("*"))
-    return null;
-  const pf = fold(payee);
-  if (pf.length < 4)
-    return null;
-  for (const a of allowed) {
-    if (a === "*")
-      continue;
-    const af = fold(a);
-    if (af.length < 4)
-      continue;
-    if (pf === af)
-      return a;
-    const d = lev(pf, af, 2);
-    if (d > 0 && d <= 2)
-      return a;
-  }
-  return null;
+function configPath() {
+  return join(configDir(), "config.json");
 }
-function validateMandateCaps(mandate) {
-  const bad = (v) => typeof v !== "number" || !Number.isFinite(v) || v <= 0;
-  if (!mandate.allow || typeof mandate.allow !== "object")
-    return "invalid_mandate:missing_allow";
-  if (bad(mandate.allow.perTxMax))
-    return `invalid_mandate_cap:perTxMax=${String(mandate.allow.perTxMax)}`;
-  if (bad(mandate.allow.maxTotal))
-    return `invalid_mandate_cap:maxTotal=${String(mandate.allow.maxTotal)}`;
-  if (!mandate.window || typeof mandate.window !== "object")
-    return "invalid_mandate:missing_window";
-  for (const campo of ["notBefore", "notAfter"]) {
-    const v = mandate.window[campo];
-    if (typeof v !== "string" || Number.isNaN(Date.parse(v)))
-      return `invalid_mandate_window:${campo}=${String(v)}`;
+function auditLogPath() {
+  if (process.env.FIDACY_AUDIT_PATH) return process.env.FIDACY_AUDIT_PATH;
+  const dir = join(configDir(), "audit");
+  try {
+    mkdirSync(dir, { recursive: true, mode: 448 });
+  } catch {
   }
-  return null;
+  return join(dir, "audit.log");
 }
-function evaluate(mandate, req, spentSoFar) {
-  const now = Date.now();
-  if (mandate.revoked)
-    return "mandate_revoked";
-  const badCap = validateMandateCaps(mandate);
-  if (badCap)
-    return badCap;
-  if (now < Date.parse(mandate.window.notBefore))
-    return "before_mandate_window";
-  if (now > Date.parse(mandate.window.notAfter))
-    return "after_mandate_window";
-  if (req.currency.toUpperCase() !== mandate.allow.currency.toUpperCase())
-    return `currency_not_allowed:${req.currency}`;
-  if (req.amount <= 0)
-    return "non_positive_amount";
-  if (req.amount > mandate.allow.perTxMax)
-    return `per_tx_cap_exceeded:${req.amount}>${mandate.allow.perTxMax}`;
-  if (spentSoFar + req.amount > mandate.allow.maxTotal)
-    return `total_cap_exceeded:${spentSoFar + req.amount}>${mandate.allow.maxTotal}`;
-  const payeeOk = mandate.allow.payees.includes("*") || mandate.allow.payees.includes(req.payee);
-  if (!payeeOk) {
-    const impersonated = lookalikePayee(req.payee, mandate.allow.payees);
-    if (impersonated)
-      return `payee_lookalike:${req.payee}~${impersonated}`;
-    return `payee_not_in_allowlist:${req.payee}`;
+function readConfig() {
+  const p = configPath();
+  if (!existsSync(p)) return null;
+  try {
+    const raw = JSON.parse(readFileSync(p, "utf8"));
+    if (!raw || typeof raw.anon_id !== "string") return null;
+    return {
+      anon_id: raw.anon_id,
+      tier: raw.tier === "paid" ? "paid" : "free",
+      api_key: typeof raw.api_key === "string" ? raw.api_key : null,
+      mandate: raw.mandate,
+      // Sem esta linha o campo seria descartado aqui e o bloqueio configurado
+      // pelo operador simplesmente não existiria, sem erro nenhum. É a mesma
+      // classe de defeito do teto de pagamento que era jogado fora em silêncio.
+      actionClasses: raw.actionClasses && typeof raw.actionClasses === "object" ? raw.actionClasses : void 0,
+      systems: Array.isArray(raw.systems) ? raw.systems : void 0,
+      // Install-state passthrough: dropping these on a read→write cycle would
+      // reset every once-per-install nudge into an every-time nag.
+      created_at: typeof raw.created_at === "string" ? raw.created_at : void 0,
+      nudges: raw.nudges && typeof raw.nudges === "object" ? raw.nudges : void 0,
+      decisions_count: typeof raw.decisions_count === "number" ? raw.decisions_count : void 0,
+      hosted_lapsed_at: typeof raw.hosted_lapsed_at === "string" ? raw.hosted_lapsed_at : void 0,
+      operator_email: typeof raw.operator_email === "string" ? raw.operator_email : void 0,
+      registered_email: typeof raw.registered_email === "string" ? raw.registered_email : void 0
+    };
+  } catch {
+    return null;
   }
-  const catOk = mandate.allow.categories.includes("*") || mandate.allow.categories.includes(req.category);
-  if (!catOk)
-    return `category_not_allowed:${req.category}`;
-  return null;
-}
-
-// ../firewall/dist/core.js
-function canonInvoice(ref) {
-  if (typeof ref !== "string")
-    return "";
-  return ref.normalize("NFC").replace(/[\s\u200B\u200C\u200D\uFEFF]+/g, "").toLowerCase();
 }
-function validateRequest(req) {
-  if (!req || typeof req !== "object")
-    return "invalid_request";
-  if (typeof req.amount !== "number" || !Number.isFinite(req.amount) || req.amount <= 0)
-    return "invalid_amount";
-  if (typeof req.payee !== "string" || req.payee.length === 0)
-    return "invalid_payee";
-  if (typeof req.currency !== "string" || req.currency.length === 0)
-    return "invalid_currency";
-  return null;
+function writeConfig(cfg) {
+  const dir = configDir();
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  writeFileSync(configPath(), JSON.stringify(cfg, null, 2), { mode: 384 });
 }
-function requireHttpsBase(raw) {
-  const trimmed = String(raw ?? "").replace(/\/+$/, "");
-  let u;
+function ensureState() {
+  const existing = readConfig();
+  if (existing) return { config: existing, firstRun: false };
+  const config = {
+    anon_id: randomUUID2(),
+    tier: "free",
+    api_key: null,
+    mandate: { payees: [], categories: ["*"], currency: "USD", perTxMax: 2500, maxTotal: 1e4 },
+    systems: [],
+    actionClasses: Object.fromEntries(ACTION_CLASSES.map((k) => [k.id, { mode: k.defaultMode }])),
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
   try {
-    u = new URL(trimmed);
+    writeConfig(config);
   } catch {
-    throw new Error("FIDACY_API_URL is not a valid URL");
   }
-  const localHttp = u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]");
-  if (u.protocol !== "https:" && !localHttp) {
-    throw new Error("FIDACY_API_URL must be https:// (the API key is sent to it)");
-  }
-  return trimmed;
+  return { config, firstRun: true };
 }
-var DevFidacyCore = class {
-  priv;
-  pubPem;
-  mandate;
-  store;
-  spent = 0;
-  claimedInvoices = /* @__PURE__ */ new Set();
-  onDecision;
-  constructor(opts) {
-    const kp = loadOrGenerateKeyPair();
-    this.priv = kp.privateKey;
-    this.pubPem = publicKeyPem(kp.publicKey);
-    if (kp.ephemeral)
-      console.error("[fidacy] local firewall active, deny-by-default. Grants are signed with a per-session key (fine for local use); set FIDACY_SIGNING_KEY_B64 for a stable key, or FIDACY_MODE=http to use the hosted core.");
-    this.mandate = opts.mandate;
-    this.store = new FileAuditStore(opts.auditLogPath ?? "./fidacy-audit.log");
-    this.onDecision = opts.onDecision;
-    this.rehydrate();
-  }
-  /**
-   * Rebuild the in-memory decision state from the persisted audit log, so a process
-   * restart cannot re-open a claimed invoice (BEC dedup) or reset the maxTotal
-   * counter. One O(records) pass at boot over the already-loaded chain:
-   *   - claimedInvoices: every ALLOW that carried an invoiceRef, regardless of age —
-   *     a paid invoice stays paid.
-   *   - spent: ALLOW amounts whose timestamp falls inside the CURRENT mandate window
-   *     and whose currency matches the mandate (the cap is defined per window/currency).
-   * Records from older versions lack the rehydration fields and are skipped.
-   */
-  rehydrate() {
-    const notBefore = Date.parse(this.mandate.window.notBefore);
-    const notAfter = Date.parse(this.mandate.window.notAfter);
-    for (const r of this.store.records()) {
-      if (r.status !== "ALLOW")
-        continue;
-      if (r.invoiceRef)
-        this.claimedInvoices.add(`${r.subject}|${r.invoiceRef}`);
-      if (typeof r.amount !== "number" || !Number.isFinite(r.amount))
-        continue;
-      if (r.currency !== this.mandate.allow.currency)
-        continue;
-      const t = Date.parse(r.ts);
-      if (!Number.isFinite(t) || t < notBefore || t > notAfter)
-        continue;
-      this.spent += r.amount;
+var DEMO_PAYEE = "fidacy:demo";
+function resolveMandateRules(cfg) {
+  const m = cfg?.mandate ?? {};
+  const envList = (v) => v === void 0 ? void 0 : v.split(",").map((s) => s.trim()).filter(Boolean);
+  const envNum = (name, v) => {
+    if (v === void 0 || v.trim() === "") return void 0;
+    const n = Number(v);
+    if (!Number.isFinite(n) || n <= 0) {
+      console.error(
+        `[fidacy] ${name}="${v}" is not a positive number, so it cannot be enforced as a cap. Ignoring it and using the safe default. Write digits only, with no thousands separator, currency symbol or unit (e.g. ${name}=2500).`
+      );
+      return void 0;
+    }
+    return n;
+  };
+  const fileNum = (name, v) => {
+    if (v === void 0 || v === null) return void 0;
+    const n = typeof v === "number" ? v : typeof v === "string" ? Number(v.trim()) : NaN;
+    if (!Number.isFinite(n) || n <= 0) {
+      console.error(
+        `[fidacy] mandate.${name} in config.json is ${JSON.stringify(v)}, which is not a positive number, so it cannot be enforced as a cap. Ignoring it and using the safe default. Write it as a bare JSON number, with no quotes, thousands separator, currency symbol or unit (e.g. "${name}": 2500).`
+      );
+      return void 0;
     }
+    return n;
+  };
+  const payees = envList(process.env.FIDACY_ALLOW_PAYEES) ?? m.payees ?? [];
+  return {
+    payees: payees.includes(DEMO_PAYEE) ? payees : [...payees, DEMO_PAYEE],
+    categories: envList(process.env.FIDACY_ALLOW_CATEGORIES) ?? m.categories ?? ["*"],
+    currency: process.env.FIDACY_CURRENCY ?? m.currency ?? "USD",
+    perTxMax: envNum("FIDACY_PER_TX_MAX", process.env.FIDACY_PER_TX_MAX) ?? fileNum("perTxMax", m.perTxMax) ?? 2500,
+    maxTotal: envNum("FIDACY_MAX_TOTAL", process.env.FIDACY_MAX_TOTAL) ?? fileNum("maxTotal", m.maxTotal) ?? 1e4
+  };
+}
+
+// ../mcp/src/evidence.ts
+var GENESIS = "fidacy.observer.v1";
+var sha2562 = (s) => createHash("sha256").update(s).digest("hex");
+function canonical(obj) {
+  const keys = Object.keys(obj).sort();
+  return "{" + keys.map((k) => `${JSON.stringify(k)}:${JSON.stringify(obj[k])}`).join(",") + "}";
+}
+function chainStep(prevHead, a) {
+  return sha2562(`${prevHead}|${sha2562(canonical({ category: a.category, i: a.i, tool: a.tool, ts: a.ts }))}`);
+}
+function genesisHead() {
+  return sha2562(GENESIS);
+}
+function fidacyDir() {
+  return join2(configDir(), "sessions");
+}
+function writeSessionLog(sessionId, actions, head, meta) {
+  try {
+    const dir = fidacyDir();
+    mkdirSync2(dir, { recursive: true, mode: 448 });
+    const safe = sessionId.replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 80) || "session";
+    const path = join2(dir, `${safe}.json`);
+    const body = {
+      v: "fidacy.observer.v1",
+      recipe: 'h_0 = sha256("fidacy.observer.v1"); h_i = sha256(h_prev + "|" + sha256(canonical(action)))',
+      sessionId,
+      head,
+      ...meta,
+      actions
+    };
+    writeFileSync2(path, JSON.stringify(body, null, 2), { mode: 384 });
+    return path;
+  } catch {
+    return null;
   }
-  /**
-   * Swap the active mandate (shell config hot-reload: edit config.json, the next
-   * call picks it up, no host restart). Decision state is REBUILT from the audit
-   * log under the new window/currency, so a reload can never reset the BEC
-   * invoice dedup or undercount spend: a paid invoice stays paid, spent is
-   * recomputed.
-   */
-  setMandate(m) {
-    this.mandate = m;
-    this.spent = 0;
-    this.claimedInvoices.clear();
-    this.rehydrate();
+}
+function queuePending(head, sessionId, at, total = 0, byCategory = {}) {
+  try {
+    const dir = fidacyDir();
+    mkdirSync2(dir, { recursive: true, mode: 448 });
+    appendFileSync(join2(dir, "pending-anchors.jsonl"), JSON.stringify({ head, sessionId, at, total, byCategory }) + "\n", {
+      mode: 384
+    });
+  } catch {
   }
-  async getMandate() {
-    return this.mandate;
+}
+function takePending(limit = 50) {
+  const dir = fidacyDir();
+  const path = join2(dir, "pending-anchors.jsonl");
+  const taken = join2(dir, "pending-anchors.taking");
+  try {
+    renameSync(path, taken);
+  } catch {
+    return [];
   }
-  async decide(req, subject) {
-    const decisionId = randomUUID2();
-    const ts2 = (/* @__PURE__ */ new Date()).toISOString();
-    const invalid = validateRequest(req);
-    if (invalid) {
-      const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: invalid, ts: ts2 };
-      this.store.append(decision2);
-      this.onDecision?.(decision2);
-      return decision2;
-    }
-    const violated = evaluate(this.mandate, req, this.spent);
-    if (violated) {
-      const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: violated, ts: ts2 };
-      this.store.append(decision2);
-      this.onDecision?.(decision2);
-      return decision2;
-    }
-    const invoice = canonInvoice(req.invoiceRef);
-    if (invoice) {
-      const k = `${subject}|${invoice}`;
-      if (this.claimedInvoices.has(k)) {
-        const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: `duplicate_invoice:${invoice}`, ts: ts2 };
-        this.store.append(decision2);
-        this.onDecision?.(decision2);
-        return decision2;
+  try {
+    const lines = readFileSync2(taken, "utf8").split("\n").filter(Boolean);
+    const out = [];
+    for (const line of lines.slice(-limit)) {
+      try {
+        const p = JSON.parse(line);
+        if (typeof p.head === "string" && /^[0-9a-f]{64}$/.test(p.head)) out.push(p);
+      } catch {
       }
-      this.claimedInvoices.add(k);
     }
-    const grantPayload = { decisionId, subject, payee: req.payee, amount: req.amount, currency: req.currency, exp: Date.now() + 12e4, ...req.invoiceRef ? { invoiceRef: req.invoiceRef } : {} };
-    const grantBody = Buffer.from(stableStringify(grantPayload), "utf8").toString("base64url");
-    const grant = `${grantBody}.${sign(this.priv, grantBody)}`;
-    const decision = { decisionId, status: "ALLOW", subject, mandateId: this.mandate.id, request: req, grant, ts: ts2 };
-    this.spent += req.amount;
-    this.store.append(decision);
-    this.onDecision?.(decision);
-    return decision;
-  }
-  async getProof(decisionId) {
-    const record3 = this.store.find(decisionId);
-    if (!record3)
-      return null;
-    return { record: record3, chainIntact: this.store.intact(), verifiedAgainstPublicKey: this.pubPem };
-  }
-  async history(limit = 50) {
-    const all = this.store.records();
-    return limit > 0 && all.length > limit ? all.slice(-limit) : all;
-  }
-  publicKey() {
-    return this.pubPem;
+    return out;
+  } catch {
+    return [];
+  } finally {
+    try {
+      writeFileSync2(taken, "");
+    } catch {
+    }
   }
+}
+function verifyUrl(head) {
+  return `https://fidacy.com/verify?sha256=${head}`;
+}
+var CODE = {
+  money: "m",
+  shell: "s",
+  file: "f",
+  network: "net",
+  message: "msg",
+  other: "o"
 };
-var HttpFidacyCore = class {
-  apiKey;
-  subjectPub;
-  baseUrl;
-  // Enforce https before any key-bearing request — a hostile FIDACY_API_URL would
-  // otherwise exfiltrate the API key in the Authorization header.
-  constructor(baseUrl, apiKey, subjectPub = "") {
-    this.apiKey = apiKey;
-    this.subjectPub = subjectPub;
-    this.baseUrl = requireHttpsBase(baseUrl);
-  }
-  async call(path, body) {
-    const res = await fetch(`${this.baseUrl}${path}`, {
-      method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${this.apiKey}` },
-      body: JSON.stringify(body)
-    });
-    if (!res.ok)
-      throw new Error(`fidacy core ${path} -> ${res.status}`);
-    return await res.json();
-  }
-  async getMandate(subject) {
-    return this.call("/v1/mandate/get", { subject });
-  }
-  async decide(req, subject) {
-    return this.call("/v1/decide", { req, subject });
-  }
-  async getProof(decisionId) {
-    return this.call("/v1/audit/proof", { decisionId });
+function sessionLabel(sessionId, total, byCategory) {
+  const id = sessionId.replace(/[^A-Za-z0-9-]/g, "").slice(0, 8) || "unknown";
+  const parts = [`session:${id}`, `n=${total}`];
+  for (const [cat, code] of Object.entries(CODE)) {
+    const n = byCategory[cat] ?? 0;
+    if (n > 0) parts.push(`${code}=${n}`);
   }
-  async history(limit = 50) {
-    const res = await this.call("/v1/audit/list", { limit });
-    return res.records ?? [];
+  return parts.join(" ").slice(0, 120);
+}
+function sessionSummary(opts) {
+  const by = {};
+  for (const [cat, n] of Object.entries(opts.byCategory)) if (n > 0) by[cat] = n;
+  const s = {
+    v: 1,
+    // Mesmo saneamento do rótulo: o host vem de código nosso, mas o campo é
+    // limitado na origem para que uma string estranha vire um valor curto e
+    // legível em vez de um 400 que perderia o registro inteiro da sessão.
+    host: opts.host.replace(/[^a-z0-9-]/gi, "").slice(0, 40) || "unknown",
+    session_id: opts.sessionId.replace(/[^A-Za-z0-9-]/g, "").slice(0, 64) || "unknown",
+    total: opts.total
+  };
+  if (Object.keys(by).length) s.by_category = by;
+  if (opts.truncated) s.truncated = true;
+  if (opts.startedAt) s.started_at = opts.startedAt;
+  if (opts.endedAt) s.ended_at = opts.endedAt;
+  return s;
+}
+
+// ../mcp/src/observer.ts
+var EXACT = {
+  // Fidacy's own money tools, so the report counts what we ourselves gated.
+  request_payment: "money",
+  assess_action: "money",
+  // The common OpenClaw / agent-host tool vocabulary.
+  bash: "shell",
+  shell: "shell",
+  exec: "shell",
+  run_command: "shell",
+  code_mode_exec: "shell",
+  read: "file",
+  read_file: "file",
+  write: "file",
+  write_file: "file",
+  edit: "file",
+  edit_file: "file",
+  apply_patch: "file",
+  glob: "file",
+  grep: "file",
+  ls: "file",
+  fetch: "network",
+  web_fetch: "network",
+  web_search: "network",
+  http_request: "network",
+  browser: "network",
+  send_message: "message",
+  reply: "message",
+  send_email: "message"
+};
+var FUZZY = [
+  ["payment", "money"],
+  ["invoice", "money"],
+  ["transfer", "money"],
+  ["charge", "money"],
+  ["file", "file"],
+  ["patch", "file"],
+  ["write", "file"],
+  ["read", "file"],
+  ["fetch", "network"],
+  ["http", "network"],
+  ["browser", "network"],
+  ["search", "network"],
+  ["exec", "shell"],
+  ["command", "shell"],
+  ["shell", "shell"],
+  ["mail", "message"],
+  ["message", "message"],
+  ["send", "message"]
+];
+function classify(toolName, derivedPaths) {
+  const name = toolName.toLowerCase();
+  const exact = EXACT[name];
+  if (exact) return exact;
+  if (derivedPaths && derivedPaths.length > 0) return "file";
+  for (const [needle, category] of FUZZY) if (name.includes(needle)) return category;
+  return "other";
+}
+function fingerprint(toolName, derivedPaths) {
+  const target = derivedPaths && derivedPaths.length > 0 ? [...derivedPaths].sort().join("\0") : toolName;
+  return createHash2("sha256").update(`${toolName}\0${target}`).digest("hex").slice(0, 16);
+}
+var ACTION_LOG_CAP = 5e3;
+function newLedger(sessionId, now) {
+  return {
+    sessionId,
+    startedAt: now,
+    byCategory: /* @__PURE__ */ new Map(),
+    total: 0,
+    toolsSeen: /* @__PURE__ */ new Set(),
+    head: genesisHead(),
+    actions: [],
+    truncated: false
+  };
+}
+function record(ledger, toolName, derivedPaths, failed = false, at = Date.now()) {
+  const category = classify(toolName, derivedPaths);
+  let tally = ledger.byCategory.get(category);
+  if (!tally) {
+    tally = { calls: 0, failures: 0, targets: /* @__PURE__ */ new Set() };
+    ledger.byCategory.set(category, tally);
   }
-  publicKey() {
-    return this.subjectPub;
+  tally.calls += 1;
+  if (failed) tally.failures += 1;
+  if (derivedPaths && derivedPaths.length > 0 && tally.targets.size < TARGET_CAP) {
+    tally.targets.add(fingerprint(toolName, derivedPaths));
   }
+  ledger.total += 1;
+  if (ledger.toolsSeen.size < TOOLS_CAP) ledger.toolsSeen.add(toolName);
+  const action = {
+    i: ledger.total,
+    category,
+    tool: toolName,
+    ts: new Date(at).toISOString()
+  };
+  ledger.head = chainStep(ledger.head, action);
+  if (ledger.actions.length < ACTION_LOG_CAP) ledger.actions.push(action);
+  else ledger.truncated = true;
+}
+var TARGET_CAP = 500;
+var TOOLS_CAP = 200;
+var ORDER = ["money", "shell", "file", "network", "message", "other"];
+var LABEL = {
+  money: "moved money",
+  shell: "ran commands",
+  file: "touched files",
+  network: "reached the network",
+  message: "sent messages",
+  other: "other"
 };
-
-// ../firewall/dist/audit-store.js
-var FileAuditStore = class {
-  path;
-  chain = [];
-  constructor(path) {
-    this.path = path;
-    this.load();
+function renderReport(ledger, now, activated, logPath) {
+  if (ledger.total < MIN_ACTIONS_FOR_REPORT) return null;
+  const minutes = Math.max(1, Math.round((now - ledger.startedAt) / 6e4));
+  const lines = [];
+  lines.push(
+    `[fidacy] SESSION REPORT \xB7 ${ledger.total} agent actions watched over ${minutes} min \xB7 nothing left this machine`
+  );
+  for (const category of ORDER) {
+    const tally = ledger.byCategory.get(category);
+    if (!tally) continue;
+    const capped = tally.targets.size >= TARGET_CAP ? "+" : "";
+    const parts = [`${tally.calls} ${tally.calls === 1 ? "call" : "calls"}`];
+    if (tally.targets.size > 0) parts.push(`${tally.targets.size}${capped} distinct`);
+    if (tally.failures > 0) parts.push(`${tally.failures} failed`);
+    lines.push(`[fidacy]   ${LABEL[category].padEnd(20)} ${parts.join(" \xB7 ")}`);
   }
-  load() {
-    if (!fs.existsSync(this.path))
-      return;
-    try {
-      const raw = fs.readFileSync(this.path, "utf8");
-      const lines = raw.split("\n");
-      const parsed = [];
-      let torn = false;
-      for (let i = 0; i < lines.length; i++) {
-        if (!lines[i].trim())
-          continue;
-        try {
-          parsed.push(JSON.parse(lines[i]));
-        } catch {
-          if (lines.slice(i + 1).some((l) => l.trim()))
-            throw new Error(`unparseable record at line ${i + 1}`);
-          torn = true;
-          break;
-        }
-      }
-      this.chain = parsed;
-      if (!this.intact())
-        throw new Error("audit chain integrity broken");
-      if (torn) {
-        const clean = parsed.map((r) => JSON.stringify(r)).join("\n") + (parsed.length ? "\n" : "");
-        fs.writeFileSync(this.path, clean);
-        console.error(`[fidacy] audit log at ${this.path} had a torn trailing line (crash during append?); salvaged ${parsed.length} intact records and truncated the tail.`);
-      }
-    } catch (err) {
-      this.chain = [];
+  const money2 = ledger.byCategory.get("money");
+  if (!money2) {
+    lines.push(`[fidacy]   no money-moving action was attempted \xB7 the firewall stayed armed and idle`);
+  }
+  lines.push(`[fidacy]   digest    ${ledger.head}`);
+  if (logPath) lines.push(`[fidacy]   log       ${logPath}${ledger.truncated ? " (partial: action cap reached)" : ""}`);
+  lines.push(
+    activated ? `[fidacy]   anchored to the audit chain \xB7 verify: ${verifyUrl(ledger.head)}` : `[fidacy]   activate free to anchor this digest so nobody can rewrite it later: https://fidacy.com/claim`
+  );
+  return lines.join("\n");
+}
+var MIN_ACTIONS_FOR_REPORT = 5;
+function installObserver(api, emit, isActivated, now = Date.now, anchor) {
+  if (typeof api?.on !== "function") return;
+  const ledgers = /* @__PURE__ */ new Map();
+  const LEDGER_CAP = 50;
+  const ledgerFor = (sessionId) => {
+    let ledger = ledgers.get(sessionId);
+    if (!ledger) {
+      if (ledgers.size >= LEDGER_CAP) ledgers.delete(ledgers.keys().next().value);
+      ledger = newLedger(sessionId, now());
+      ledgers.set(sessionId, ledger);
+    }
+    return ledger;
+  };
+  api.on(
+    "before_tool_call",
+    (event, ctx) => {
       try {
-        const quarantine = `${this.path}.corrupt-${Date.now()}`;
-        fs.renameSync(this.path, quarantine);
-        console.error(`[fidacy] audit log at ${this.path} is unreadable/tampered (${err.message}); quarantined to ${quarantine}, starting a fresh chain.`);
+        const toolName = typeof event.toolName === "string" ? event.toolName : "unknown";
+        const paths = Array.isArray(event.derivedPaths) ? event.derivedPaths : void 0;
+        const sessionId = sessionIdOf(ctx);
+        record(ledgerFor(sessionId), toolName, paths, false);
       } catch {
-        console.error(`[fidacy] audit log at ${this.path} is unreadable/tampered and could not be quarantined; starting a fresh in-memory chain.`);
       }
+    },
+    // Lowest priority on purpose: anything that actually decides should run first,
+    // and we only want to count what the host was really about to do.
+    { priority: 1 }
+  );
+  api.on("session_end", async (event, ctx) => {
+    try {
+      const sessionId = sessionIdOf(ctx) || (typeof event.sessionId === "string" ? event.sessionId : "");
+      const ledger = ledgers.get(sessionId);
+      if (!ledger) return;
+      ledgers.delete(sessionId);
+      if (ledger.total < MIN_ACTIONS_FOR_REPORT) return;
+      const logPath = persist(ledger, now());
+      let anchored = false;
+      if (anchor) {
+        anchored = await anchor(ledger.head, ledger.sessionId, rollup(ledger)).catch(() => false);
+      }
+      if (!anchored) queuePending(ledger.head, ledger.sessionId, now(), ledger.total, rollup(ledger));
+      const report = renderReport(ledger, now(), anchored, logPath);
+      if (report) emit(report);
+    } catch {
     }
-  }
-  head() {
-    return this.chain.length ? this.chain[this.chain.length - 1].hash : "GENESIS";
-  }
-  append(decision) {
-    const prevHash = this.head();
-    const seq = this.chain.length;
-    const ts2 = decision.ts;
-    const digest = sha2562(stableStringify({ decisionId: decision.decisionId, status: decision.status, request: decision.request, violatedRule: decision.violatedRule ?? null }));
-    const hash = sha2562(`${prevHash}|${digest}|${seq}|${ts2}`);
-    const record3 = { seq, decisionId: decision.decisionId, status: decision.status, subject: decision.subject, digest, prevHash, hash, ts: ts2 };
-    if (typeof decision.request?.purpose === "string" && decision.request.purpose.trim()) {
-      record3.purpose = decision.request.purpose.slice(0, 500);
-    }
-    if (typeof decision.request?.payee === "string" && decision.request.payee.trim()) {
-      record3.payee = decision.request.payee.slice(0, 200);
-    }
-    if (decision.status === "ALLOW") {
-      const req = decision.request;
-      if (typeof req?.amount === "number" && Number.isFinite(req.amount))
-        record3.amount = req.amount;
-      if (typeof req?.currency === "string")
-        record3.currency = req.currency;
-      const invoice = canonInvoice(req?.invoiceRef);
-      if (invoice)
-        record3.invoiceRef = invoice;
-    } else {
-      if (decision.violatedRule)
-        record3.violatedRule = decision.violatedRule;
-      const req = decision.request;
-      if (typeof req?.amount === "number" && Number.isFinite(req.amount))
-        record3.amount = req.amount;
-      if (typeof req?.currency === "string")
-        record3.currency = req.currency;
+  });
+  api.on("gateway_stop", () => drain());
+  process.on("exit", () => drain());
+  function drain() {
+    try {
+      for (const [id, ledger] of ledgers) {
+        ledgers.delete(id);
+        if (ledger.total < MIN_ACTIONS_FOR_REPORT) continue;
+        const logPath = persist(ledger, now());
+        queuePending(ledger.head, ledger.sessionId, now(), ledger.total, rollup(ledger));
+        const report = renderReport(ledger, now(), false, logPath);
+        if (report) emit(report);
+      }
+    } catch {
     }
-    fs.appendFileSync(this.path, JSON.stringify(record3) + "\n");
-    this.chain.push(record3);
-    return record3;
-  }
-  find(decisionId) {
-    return this.chain.find((r) => r.decisionId === decisionId);
   }
-  /** The full loaded chain, oldest first. Read-only; used to rehydrate core state at boot. */
-  records() {
-    return this.chain;
+  function rollup(ledger) {
+    const out = {};
+    for (const [cat, tally] of ledger.byCategory) out[cat] = tally.calls;
+    return out;
   }
-  intact() {
-    let prev = "GENESIS";
-    for (const r of this.chain) {
-      const expected = sha2562(`${prev}|${r.digest}|${r.seq}|${r.ts}`);
-      if (expected !== r.hash || r.prevHash !== prev)
-        return false;
-      prev = r.hash;
-    }
-    return true;
+  function persist(ledger, at) {
+    return writeSessionLog(ledger.sessionId, ledger.actions, ledger.head, {
+      startedAt: new Date(ledger.startedAt).toISOString(),
+      endedAt: new Date(at).toISOString(),
+      totalActions: ledger.total,
+      truncated: ledger.truncated,
+      byCategory: Object.fromEntries(
+        [...ledger.byCategory].map(([k, v]) => [k, { calls: v.calls, failures: v.failures, distinct: v.targets.size }])
+      )
+    });
   }
-};
+}
+function sessionIdOf(ctx) {
+  if (!ctx) return "default";
+  const id = ctx.sessionId ?? ctx.sessionKey;
+  return typeof id === "string" && id.length > 0 ? id : "default";
+}
 
 // ../mcp/src/core.ts
 import { statSync } from "node:fs";
 
 // ../mcp/src/telemetry.ts
-var CLIENT_VERSION = true ? "0.5.10" : "dev";
+var CLIENT_VERSION = true ? "0.6.0" : "dev";
 function bandOf(amount) {
   if (typeof amount !== "number" || !Number.isFinite(amount) || amount <= 0) return void 0;
   if (amount < 10) return "lt10";
@@ -5317,7 +5391,7 @@ function requestUpgrade() {
 }
 
 // ../mcp/src/provision.ts
-var CLIENT_VERSION2 = true ? "0.5.10" : "dev";
+var CLIENT_VERSION2 = true ? "0.6.0" : "dev";
 function provisionEnabled() {
   const v = (process.env.FIDACY_DISABLE_PROVISION ?? "").trim().toLowerCase();
   return !(v === "1" || v === "true" || v === "yes");
@@ -5460,7 +5534,7 @@ function trialCountdownLine(keyOverride) {
 }
 
 // ../mcp/src/register.ts
-var CLIENT_VERSION3 = true ? "0.5.10" : "dev";
+var CLIENT_VERSION3 = true ? "0.6.0" : "dev";
 function endpoint3() {
   const base = (process.env.FIDACY_ENGINE_URL ?? "https://api.fidacy.com").replace(/\/$/, "");
   return `${base}/v1/register`;